[00:01.370 --> 00:07.230]  Welcome to Safe Cracking for Everyone! A little bit about myself, who am I? My name is Jared
[00:07.230 --> 00:12.650]  Digert. I'm a lock support enthusiast, gamer, rock climber, game developer, and I've been picking
[00:12.650 --> 00:19.370]  locks and cracking safes for about a decade now. So this talk is going to cover how Group 2 safe
[00:19.370 --> 00:27.270]  locks work, and mechanical combination safe locks are divided into two groups. There's Group 2s,
[00:27.270 --> 00:33.170]  which is your basic safe lock, no anti-manipulation features in them, also the most common type,
[00:33.170 --> 00:37.750]  and then there's Group 1s, which are more complicated and include various different
[00:37.750 --> 00:44.730]  measures to keep people from figuring out the combination. Now, whether you buy a $500 safe
[00:44.730 --> 00:51.910]  or a $5,000 safe, if it comes with a mechanical safe lock, it will most likely be a Group 2 safe
[00:51.910 --> 00:59.570]  lock. Very rarely are there Group 1 safe locks that come by default on a safe. Usually you have
[00:59.570 --> 01:06.570]  to pay hundreds of dollars extra for the lock, even more to get it installed, and this is not
[01:06.570 --> 01:12.290]  very common at all. So I'll be covering these Group 2 safe locks in this talk. I'll cover the
[01:12.290 --> 01:17.590]  flaws in this design and how to exploit them, along with specific techniques that is used to
[01:17.590 --> 01:23.150]  crack the combination. And at the end, I'll cover some slight differences between various Group 2
[01:23.150 --> 01:29.390]  safe locks, since not all manufacturers create them the same way. First thing is knowing the
[01:29.390 --> 01:34.610]  parts of the lock. So this is the back of the lock with the back cover removed, and you can see that
[01:34.610 --> 01:40.590]  there is a silver lever here. Now, the end of this lever has a protrusion, and this protrusion is
[01:40.590 --> 01:48.250]  called the nose. This nose is resting on a brass wheel. The brass wheel is called a drive cam,
[01:48.650 --> 01:55.730]  and this drive cam, you can see, has a cutout in it. This space, this empty space in the drive cam,
[01:55.730 --> 02:04.270]  is called the contact area. You can see where the cutout starts on either end, and those are the
[02:04.270 --> 02:11.910]  contact points. So the cutout is the contact area, and each end of the cutout, where it starts, is the
[02:11.910 --> 02:19.190]  contact points. And this drive cam is controlled directly by the dial. So there's a metal rod, you
[02:19.190 --> 02:23.770]  can see, in the middle, and that connects it directly to the dial. It's locked in place with
[02:23.770 --> 02:31.490]  this key. So whenever you turn the dial, the drive cam moves at the same time with the dial.
[02:32.270 --> 02:38.790]  Behind the drive cam, you can see a larger silver wheel. There's three of these wheels, generally,
[02:38.790 --> 02:44.550]  in each lock. Sometimes there could be four, but most often times it's three. Now, this wheel that
[02:44.550 --> 02:51.130]  we see here is called wheel three. It's the third wheel. It's closest to the drive cam, and when
[02:51.130 --> 02:57.770]  you're in front of the lock, it would be furthest away from you. And the other two wheels are behind
[02:57.770 --> 03:04.810]  it. Now, each of these wheels are exactly the same. There is a cutout in each of these wheels
[03:04.810 --> 03:13.780]  called a gate. Now, these gates are part of when you dial the combination.
[03:14.810 --> 03:24.550]  The gates all line up, and there is a metal bar behind this lever, and it lines up all of these
[03:24.550 --> 03:30.930]  gates under the metal bar when you dial the correct combination. So that when you turn the dial
[03:30.930 --> 03:37.150]  and the drive cam, so the contact area is under the nose, everything can fall down and fit nice
[03:37.150 --> 03:45.150]  and easily. So here, you would just continue turning the dial, and that would pull in this lever,
[03:45.150 --> 03:50.530]  and that retracts a bolt. The lever is attached to the bolt, and that pulls it in so that you
[03:50.530 --> 03:58.350]  can turn the handle and open the safe. The handle of a safe just pulls in the outermost bolts around
[03:58.350 --> 04:04.610]  the edge of the door so that you can open it, but the lock itself only locks the handle. So that's
[04:04.610 --> 04:10.870]  basically how safes operate. It's a locking mechanism locks the handle, and the handle is
[04:10.870 --> 04:18.190]  what pulls in the bolts from the outer edge of the door. Now, to demonstrate that,
[04:18.930 --> 04:24.690]  I have a lock here, and if we look at the back, you can see the drive cam.
[04:25.050 --> 04:30.870]  Whenever I spin the dial, the drive cam moves with the dial.
[04:32.150 --> 04:40.930]  So if I were to dial in the combination, that would involve putting the gate of the first wheel
[04:41.890 --> 04:50.190]  under the fence, and then I would put the gate of the second wheel under the fence as well. I messed
[04:50.190 --> 05:00.010]  that up, but I will just fix it. And then I put the gate of the third wheel under the fence. I simply
[05:00.010 --> 05:07.270]  turn the drive cam so everything can fall in, and then that will retract this bolt when I continue
[05:07.270 --> 05:21.900]  turning. Now the way that it works is each of these wheels has a protrusion on one side, and
[05:21.900 --> 05:29.920]  that fits into a groove of the next wheel. Now this protrusion will ride in this groove as the wheel
[05:29.920 --> 05:37.460]  spins until it hits this metal piece of the next wheel, at which point this next wheel will start
[05:37.460 --> 05:45.380]  to spin along with the previous wheel. And this wheel also has a protrusion which rides in a groove
[05:46.020 --> 05:54.560]  of the wheel next to it, and then after a whole rotation it will hit this metal bit, and then the
[05:54.560 --> 06:00.880]  next wheel will start to spin along with the rest of the wheels, essentially picking up each wheel
[06:00.880 --> 06:07.560]  after each rotation. So the drive cam has that sort of
[06:09.920 --> 06:15.160]  protrusion as well. So right now everything is spinning together, but if I were to spin the other
[06:15.160 --> 06:21.620]  way, you can see it is only the drive cam spinning until I make one full rotation, and then this third
[06:21.620 --> 06:28.200]  wheel, the wheel closest to the drive cam, starts spinning with it. So the third wheel gets picked
[06:28.200 --> 06:35.700]  up first, and then after another full rotation, you can see that the second wheel starts to get
[06:35.700 --> 06:42.920]  picked up as well, and it is spinning along with it. After another rotation, then this third wheel,
[06:42.920 --> 06:48.600]  or this first wheel, gets picked up as well. And the wheels are named this way because the first
[06:48.600 --> 06:53.980]  wheel corresponds to the first number in the combination. Since it is the last to get picked up,
[06:53.980 --> 07:03.780]  then it is set first. So then you can freely mess about with the other two wheels without upsetting
[07:04.380 --> 07:10.020]  the position of that first one. So the third wheel gets picked up first, corresponding to the third
[07:10.020 --> 07:20.110]  number in the combination, then the second wheel, and then the first wheel. Now the standard opening
[07:20.110 --> 07:25.310]  procedure for a lock is to spin four times with left rotation to the first number, which means
[07:25.310 --> 07:31.470]  you pass the first number three times, and you stop on the fourth. Then you reverse directions,
[07:31.470 --> 07:37.050]  because if you were to keep going, it would mess up the position of the first wheel. So you reverse
[07:37.050 --> 07:45.290]  direction, spin three times with right rotation, so now we are turning clockwise to the second
[07:45.290 --> 07:51.150]  number. And then you do that three times. So you pass the second number twice, stop on the third
[07:51.150 --> 07:56.750]  time, and then twice with counterclockwise rotation, so we are reversing rotation again
[07:56.750 --> 08:02.890]  to the final number. We pass it once, and then we stop on the second time. Then we turn right until
[08:02.890 --> 08:10.010]  the bolt is retracted. Now the reason for this is because you have to spin three times to ensure all
[08:10.010 --> 08:16.550]  the wheels are picked up. You don't know the state of this wheel pack when you approach the lock,
[08:16.550 --> 08:23.150]  so it could be someone spun it to the right all the way before you approached it. So you want to
[08:23.150 --> 08:31.690]  make sure you spin one full rotation will pick up that third wheel, two full rotations picks up the
[08:31.690 --> 08:38.510]  second wheel, and then three full rotations ensures that that first wheel gets picked up. So we just
[08:38.510 --> 08:45.910]  pass the first number in the combination three times. So now we have to go to it and stop on the
[08:46.550 --> 08:51.890]  fourth time. We reverse directions because otherwise it would mess up the position of that
[08:51.890 --> 08:58.670]  first wheel. So we do one full rotation, pick up the third wheel, two full rotations, now we pick up the
[08:58.670 --> 09:08.210]  second wheel, and so we pass the second number twice, and we stop on the third time. And I overshot
[09:08.210 --> 09:15.190]  it again. Reverse directions, one full rotation picks up the third wheel, and then we stop on the second
[09:15.190 --> 09:27.370]  time. And then we can turn right so everything drops in and the bolt retracts. Here's a really
[09:27.370 --> 09:33.490]  bad drawing. I mislabeled this. This is wheel two in the middle. So the dial will turn the drive cam
[09:33.490 --> 09:40.870]  until this protrusion picks up wheel three, and then after rotating for some time, wheel three
[09:40.870 --> 09:47.070]  will pick up wheel two, and then wheel two after rotating will pick up wheel one, and so then they'll
[09:47.070 --> 09:55.290]  all start spinning together. There's a lot of vulnerabilities in this design. So you can see here
[09:55.290 --> 10:02.310]  when none of the numbers are dialed in correctly, and then we turn the drive cam, we turn the dial
[10:02.310 --> 10:09.890]  so that the contact area is under the nose. That allows the fence to drop down onto the
[10:09.890 --> 10:16.590]  wheel pack, essentially testing it for the correct combination. But the thing is, these wheels,
[10:16.590 --> 10:22.530]  they're not perfectly circular, and they're not the same size as each other. Some will be bigger,
[10:22.530 --> 10:27.330]  some will be smaller, and some will have bumps and dips, and that's because of manufacturing
[10:27.330 --> 10:35.830]  tolerances. It's basically impossible to get rid of these imperfections. What this means is,
[10:35.830 --> 10:42.550]  since one of these wheels is bigger, the fence is not going to be resting on all of the wheels at
[10:42.550 --> 10:50.450]  the same time. You can see here, between wheel three and the fence, there's actually a bit of space.
[10:50.450 --> 10:58.150]  It's not touching. Wheel two here, you can see, is larger than wheel three and wheel one. This fence
[10:58.150 --> 11:06.650]  is only touching wheel two. Now, we can also see that this contact area, where the contact points
[11:06.650 --> 11:15.370]  are on either end, it is sloped to go down. And that means there is less wiggle room, so to speak,
[11:15.370 --> 11:22.810]  between the sides of the contact area the further down you go. So let's assume that wheel two,
[11:22.810 --> 11:29.770]  let's pretend that the wheel two combination is valid, that the gate for wheel two is now under
[11:30.490 --> 11:35.710]  this fence. Well, what would happen? Well, this fence would not rest on wheel two anymore. It would
[11:35.710 --> 11:42.570]  drop down ever so slightly and rest on wheel three. That means this nose would be lower in the
[11:42.570 --> 11:51.630]  contact area and there's less wiggle room between the contact points. The really cool thing about
[11:51.630 --> 12:04.410]  this is you can feel this on the dial. So if I were to reset this, you can see that the nose drops
[12:04.410 --> 12:10.790]  into the contact area when it's over the contact area and that allows the fence to rest onto
[12:11.610 --> 12:22.170]  the wheel pack. So if the largest wheel has the gate under the fence, this nose is lower. And so
[12:22.170 --> 12:27.430]  this wiggle room, you can feel this bit of resistance. You can feel each contact point
[12:28.010 --> 12:38.290]  from the dial. That wiggle room would be less. So the contact points, about 96 for the left one,
[12:38.290 --> 12:47.090]  we name it from viewing the dial. So the more sloped side here on the left in this view
[12:47.090 --> 12:51.790]  is the right contact point because from the front of the safe, that's the right.
[12:52.530 --> 13:00.570]  Oops. So this left contact point is about 96 and the right contact point is about 3.
[13:00.910 --> 13:08.510]  But if perhaps two of the wheels were dialed with the gate under the fence, we might feel this at
[13:08.510 --> 13:18.970]  98 and 2. Thus the closer contact points, less wiggle room. So that is a major vulnerability
[13:18.970 --> 13:26.650]  and the main thing we use in order to determine the combination. So we can know through this
[13:26.650 --> 13:33.090]  when one of the gates, when the gate of the largest wheel is under the fence simply because
[13:33.090 --> 13:40.610]  there will be less wiggle room between the contact points. So the first step is finding
[13:41.050 --> 13:48.210]  a number in the combination with this information that we now have. So what we do is we have to take
[13:48.670 --> 13:56.010]  a series of test combinations every two or two and a half numbers. The tolerances of these locks
[13:56.010 --> 14:02.590]  sometimes allow you to go every two and a half, but generally it is safer just to go every two
[14:02.590 --> 14:11.310]  numbers. And there are two contact points, the left and the right, but as shown earlier the right
[14:11.310 --> 14:20.050]  contact point is more sloped. So there will be a greater change in the amount of wiggle room
[14:21.170 --> 14:26.890]  from the right contact point. The left will move in a little bit, but not as much as the right.
[14:27.250 --> 14:32.550]  So we really only need to know what the right contact point is at any given time.
[14:32.550 --> 14:39.810]  And you can graph this as well. So if I get my graph paper right here,
[14:40.830 --> 14:47.990]  you can see this is a basic layout of a graph. So along the top we have 0 to 100, and then here I
[14:47.990 --> 14:54.930]  put the closest whole number to the left contact point, one above and one below. Same thing with
[14:54.930 --> 15:01.390]  the right contact point, one above and one below. And as I mentioned, you don't really need the left
[15:01.390 --> 15:08.470]  contact point, but it is good supporting evidence if the right contact point is not really giving
[15:08.470 --> 15:15.130]  clear readings, which we will cover later. So you can graph both of the contact points like this.
[15:15.130 --> 15:25.350]  So first thing is you want to turn the dial left three times to pick up all of the wheels,
[15:25.350 --> 15:32.110]  and then stop on the first reading. So we can just say we're going to try zero. Now the reason
[15:32.110 --> 15:39.470]  we spin left and we pick up all the wheels with left rotation is because the combination is found
[15:39.470 --> 15:45.150]  or is dialed with left, right, and then left rotation. So left to the first number, right to
[15:45.150 --> 15:53.530]  the second, and then left to the third. So if we find a number, it's kind of random. We don't really
[15:53.530 --> 15:58.090]  know which wheel is going to be at first, right? We just know one of the wheels is larger than the rest,
[15:58.090 --> 16:06.690]  and we want to figure out when that wheel has a gate under the fence. So it's just,
[16:07.210 --> 16:11.810]  you know, statistics that it's going to be more likely the first and the third rather than
[16:11.810 --> 16:19.270]  the second. Also, because of the way the locks are designed, wheel three would generally be larger or
[16:19.270 --> 16:25.590]  would be the wheel that makes contact with the fence first. So that's more evidence to start with
[16:25.590 --> 16:33.910]  more reason to start with left rotation first. So what we do is we spin the dial, pick up all the
[16:33.910 --> 16:39.210]  wheels with left rotation, and then we stop at our first test combination. So in this case that would
[16:39.210 --> 16:45.390]  be zero, zero, zero. So we stop at zero. And then what we do is we want to reverse directions because
[16:45.390 --> 16:50.070]  if we were to keep going that would mess up the position of the wheels. So we reverse directions
[16:50.070 --> 16:57.670]  until we get within the contact area. So remember our contact points are 96 and 3, so we want to
[16:57.670 --> 17:02.610]  spin left until we're within that. We don't want to pass zero, because remember after one full
[17:02.610 --> 17:11.650]  rotation we pick up the third wheel. So we just want to go between zero and three, and then you
[17:11.650 --> 17:18.330]  just spin. I accidentally passed it but we'll ignore that for now. You want to gently spin the dial
[17:18.330 --> 17:24.450]  left until you hit the contact point. And you don't want to ride up on it. You don't want the nose to
[17:24.450 --> 17:33.690]  ride up onto the drive cam. You just want to go lightly and stop when you feel that bit of
[17:33.690 --> 17:44.530]  resistance. And then you can record that. So on the graph at zero down to three, let's say we feel at
[17:45.380 --> 17:54.130]  two and seven eighths. Then you can mark that from here two and seven eighths for zero. Okay so that
[17:54.130 --> 18:02.050]  can be about here. And that is also really important, is you want to be able to differentiate
[18:02.690 --> 18:09.990]  between one eighth of an increment. And that's really hard to show on camera here for this
[18:09.990 --> 18:15.450]  because it's not really precise, and also the resolution of the camera. But you want to be able
[18:15.450 --> 18:22.490]  to look at the dial and know whether it is showing like a two and seven eighths, or a three, or a 35
[18:22.490 --> 18:29.310]  and one eighth, or a 35 and two eighths. And you want to be able to accurately record that.
[18:29.310 --> 18:35.350]  Because what we're looking for is a change of a one quarter increment. So we want to make sure
[18:35.350 --> 18:40.810]  that our measurements are taken with a precision of one eighth of an increment just to be safe.
[18:48.280 --> 18:51.860]  So we're going to pretend that we did this for the entire
[18:56.180 --> 19:05.480]  I guess all the numbers of the of the safe. So if I were just to fill it in just with some
[19:07.860 --> 19:24.330]  random points, and I'm just putting a generic reading here. And as stated earlier, you can
[19:24.330 --> 19:30.150]  record the left contact point here as well. It's just that it's not going to be as much of a variation.
[19:31.410 --> 19:38.950]  So here, essentially what we're doing is we are taking the overall shape of all the wheels of
[19:38.950 --> 19:47.530]  the wheel pack, and we're just laying it out in a line. So if this were to be cut into a strip of paper
[19:48.030 --> 19:53.850]  and put into a circle, this is what the wheel pack would look like on a very fine scale.
[19:54.330 --> 19:59.790]  Because remember, they're not perfectly circular. So on a very fine scale, there's a lot of bumps
[19:59.790 --> 20:09.650]  and ridges and whatnot. Now if you remember, I'll show the picture again of the close-up.
[20:11.190 --> 20:20.190]  When the gate of the largest wheel is under the fence, that causes a drop, right? There's less
[20:20.190 --> 20:25.250]  wiggle room. That right contact point moves in, so it gets lower. The left contact point would get
[20:25.250 --> 20:30.430]  higher. So that's essentially what we're looking for on the graph. We're looking for where the
[20:30.430 --> 20:37.350]  right contact point drops down for maybe a number or two, and then goes back up. Because the gate
[20:37.350 --> 20:41.670]  would be under the fence, and then you would go past it, and it would not be under the fence
[20:41.670 --> 20:45.990]  anymore. So it would drop down and go up. So essentially, you want to look for the shape of a gate
[20:46.630 --> 20:52.650]  in this reading. Now you can see there's a drop here, but it goes on for a little while before
[20:52.650 --> 21:00.770]  going up, so that's probably not it. That would be really wide for a gate. But here, you can see
[21:00.770 --> 21:08.590]  it drops down for a quarter of an increment for two readings, and then drops back up. The thing
[21:08.590 --> 21:14.310]  about these safe locks is you don't have to be precise in dialing. That is also
[21:14.310 --> 21:20.390]  why we go every two numbers. You go from 0, 2, and then 4, every line here on this graph.
[21:20.490 --> 21:30.150]  So if the combination is 16, 28, 40, you can dial 17 or maybe 18, 28, 40, and it would still open.
[21:30.710 --> 21:37.340]  So you want to look for the shape of the gate in the graph, and that will tell you...
[21:38.420 --> 21:44.960]  The middle of that gate will tell you one of the numbers in the combination.
[21:48.390 --> 21:54.230]  Now we're going to assume that the number we found is 40. So at this point, we know that
[21:54.230 --> 22:02.710]  the largest wheel in the lock has a combination of 40 associated with it.
[22:02.890 --> 22:07.570]  But we don't know which wheel yet. We just know that one of the wheels in the lock is larger than
[22:07.570 --> 22:16.630]  the others, and the point at which the contact area goes closer together and then further apart
[22:16.630 --> 22:25.090]  centers around 40. So we do something called the high load test. We put 10 numbers lower
[22:25.880 --> 22:31.820]  on the first wheel, and then we put the other two wheels on the correct number. So we found...
[22:31.820 --> 22:40.540]  We're pretending we found 40 as the correct number. So we will throw the first wheel off by 10, 10 numbers lower.
[22:41.820 --> 22:48.920]  Now we found 40 with left rotation. So whenever we put one of the wheels on 40, it always has to be
[22:48.920 --> 22:57.060]  with left rotation. So the first number, we will use right rotation to 30. We pick up the wheels,
[22:57.060 --> 23:04.400]  all the wheels, so four rotations to 30 with right rotation. And then we spin left three times to 40.
[23:04.400 --> 23:11.680]  So that would put the second and third wheel on 40. And we will measure the contact area here. And here
[23:11.680 --> 23:15.940]  it is important to take both left and right contact points. And then what you want to do
[23:15.940 --> 23:23.480]  is figure out the space between them. So if it is at 96 and 3, that is a 7 number difference.
[23:23.480 --> 23:29.620]  So we would write down 7. And we would record that down. And then we do the same with the second wheel.
[23:29.700 --> 23:37.400]  We put the first number on the correct number. So left to 40. Left four times to 40.
[23:37.400 --> 23:44.200]  And then go right three times to 30. Putting the second wheel, throwing it off by 10 lower to the
[23:44.200 --> 23:51.640]  wrong number. And then left to 40 on the third wheel. Record the space between the contact points.
[23:51.640 --> 23:54.960]  How many numbers there are. And then write that down.
[23:56.720 --> 24:04.620]  Now we do that again for the third wheel. Left rotation four times to 40. And right twice to 30.
[24:05.060 --> 24:12.080]  That ensures that only one number is off. The other two wheels are on the correct number.
[24:12.820 --> 24:17.800]  And then you can repeat with 50 as well instead of 30. So that would be the high test.
[24:18.820 --> 24:27.900]  Now the test combination with the widest contact area is the one that 40 belongs to.
[24:28.400 --> 24:33.460]  So for instance, we did three test combinations here for this low test.
[24:33.640 --> 24:45.300]  If for this last sequence that we dialed, 40, 40, 30. If that has the contact area with the most space
[24:45.300 --> 24:52.380]  between it. Now normally before we were looking for closer contact points, but here we're looking
[24:52.380 --> 25:01.400]  for furthest apart. And the reason for that is because we have the correct number on the wheel,
[25:01.400 --> 25:08.820]  on two of the wheels, and the wrong one on one of the wheels. So if the wrong one is on, let's say
[25:09.700 --> 25:16.640]  here, let's say the third wheel has 40. So if we're intentionally putting on the wrong number,
[25:16.640 --> 25:21.200]  it's going to be a wider contact point. But seeing these two, it's got the correct number,
[25:21.200 --> 25:27.840]  so it'll be closer. So this allows us to figure out which wheel that 40 belongs to, simply by
[25:27.840 --> 25:35.520]  putting the correct number on each wheel twice, and then having it off on one of these. So if
[25:36.700 --> 25:43.180]  this wheel, if wheel three has 30, and it's wider here than the other two tests, then we can
[25:43.180 --> 25:48.700]  successfully conclude that 40 belongs to the third wheel, the third number in the combination.
[25:49.420 --> 25:55.900]  And then you can, you know, repeat with 50 just to really be sure that your readings are correct.
[25:55.980 --> 26:02.300]  So we're going to assume that 40 here is the third number in the combination. And then yeah,
[26:02.300 --> 26:09.020]  check your rotation. Anytime you dial to a correct number, you want to make sure you always
[26:09.020 --> 26:17.240]  use the correct rotation. Now we found one of the numbers in the combination, and we know it's the
[26:17.240 --> 26:24.040]  third wheel. So in order to find the other numbers, we essentially just repeat the same step
[26:24.620 --> 26:31.700]  with this new information added in. So we run the other two wheels through every two increments,
[26:31.700 --> 26:39.420]  but we have the third wheel on 40 whenever we read the contact point. So the way that this is done is
[26:40.840 --> 26:46.100]  we know that the third wheel, right, the first wheel that gets picked up, that means we have to
[26:46.100 --> 26:51.840]  set it last. That is with left rotation to 40. So what we want to do is we want to pick up
[26:51.840 --> 26:59.300]  all the wheels with right rotation now, and then we'll say let's start at zero, and then we spin
[26:59.300 --> 27:09.100]  left for one rotation. So that picks up just the third wheel, and we stop on 40. So now we have left
[27:09.100 --> 27:15.660]  rotation on 40. Now going to zero isn't going to affect any of the wheels now, remember, because
[27:15.660 --> 27:23.660]  we have to pick up the third wheel in order to affect the rest. So we can safely move around here
[27:23.660 --> 27:28.300]  without fear of disturbing the other wheels. So we can read the contact point again.
[27:28.420 --> 27:35.300]  Going from inside the contact area, we can read the right contact point and then graph it. So we
[27:35.300 --> 27:41.520]  just do this graph, and at the top we can maybe just write wheel 3 left 40, just so we know
[27:41.520 --> 27:50.640]  that we're doing this graph with wheel 3 on 40 with left rotation. And then what you can do now
[27:50.640 --> 27:55.360]  is you turn right until you reach 40. Now that picks up the third wheel.
[27:57.040 --> 28:04.200]  Go to zero where the other two wheels are resting together, and that picks up wheels 2 and
[28:04.200 --> 28:10.620]  wheels 1 at the same time, because remember we had everything picked up together. We only
[28:10.620 --> 28:16.600]  messed up wheel 3 in order to put it on 40 by itself. You can turn two numbers over,
[28:16.600 --> 28:18.740]  spin left again one full rotation
[28:20.840 --> 28:30.540]  to 40, go to the contact area, and report it down again. And we just go do that the whole way around.
[28:32.560 --> 28:38.500]  So here we can repeat the same high-low exercise. So we're going to pretend we found
[28:39.740 --> 28:46.880]  a drop in the graph and then a rise back up centered around 80. So we found 80 with right
[28:46.880 --> 28:55.560]  rotation now. So what we're going to do here is a low test. We're going to start with wheel 2,
[28:55.560 --> 29:01.100]  and we're going to throw it off by 10 onto 70. So wheel 1 we put it on the correct number,
[29:01.100 --> 29:06.180]  80, with right rotation. So that means we spin right, picking up all the wheels,
[29:06.180 --> 29:14.460]  stopping on 80. Then we spin left, picking up wheels 3 and 2. So we go three times to 70.
[29:15.180 --> 29:21.960]  And then here's where it gets interesting. We need to go to 40 now with left rotation because
[29:21.960 --> 29:30.400]  we found 40 as the correct number with left rotation for wheel 3. But if we were to continue
[29:30.400 --> 29:40.300]  past 70 left into 40, it would mess up wheel 2. So there's actually a clever way to fix this. So
[29:40.300 --> 29:47.860]  we spin right, picking up all the wheels, and then we stop on 80, which is what we found to be
[29:48.420 --> 29:56.900]  one of the other numbers. We can spin left, one rotation, picking up wheel 3, another rotation,
[29:56.900 --> 30:03.460]  picking up wheel 2, and we want to put wheel 2 with left rotation on 70. So that is 10 lower.
[30:04.360 --> 30:09.560]  And then we want to go to 40 now for the third wheel. But if we were to keep going,
[30:09.560 --> 30:16.200]  it would mess up wheel 2 on 70. So what we do is we can reverse directions here,
[30:16.200 --> 30:25.020]  pick up wheel 3 from 70, go to 40, but remember this is not the correct rotation. We're turning
[30:25.020 --> 30:33.240]  right. We need to be turning left. So we just go past it, let's say to 30, and then we can go left,
[30:33.240 --> 30:42.540]  picking up at 30, setting wheel 3 on 40, at which point we take our contact point readings,
[30:42.540 --> 30:49.920]  or our high-low test. And then again, you would write down the number of increments,
[30:49.920 --> 30:57.220]  the space between each of the contact points. And then do that with the first wheel. We throw
[30:57.220 --> 31:02.120]  the first wheel off by 10. So we go left to 70 for the first wheel, picking up all the wheels,
[31:02.120 --> 31:09.080]  and then right three times to 80, and then left to 40. So we write down the numbers. Again,
[31:09.080 --> 31:17.620]  we look at what is the widest contact area, and that will give us where our second number lies,
[31:17.620 --> 31:24.680]  which wheel it belongs to. And usually locks will read this way. It will read third wheel first,
[31:24.680 --> 31:30.040]  and then the second wheel, and then the first. But sometimes it can go other ways. But following
[31:30.040 --> 31:35.720]  this method, it doesn't really matter which wheel reads first. As long as you know how to dial in
[31:35.720 --> 31:43.960]  these numbers, then you can still do it just fine, no matter which wheel reads first. And then here,
[31:43.960 --> 31:48.300]  we have two of the numbers in combination. So let's pretend that 80 belongs to wheel 2. So it's
[31:48.440 --> 31:55.000]  a question mark for wheel 1. We know 80 is right rotation to wheel 2, and then 40 is left rotation
[31:55.000 --> 32:02.060]  to wheel 3. And the last wheel, you can graph it, but generally you just brute force it. You would
[32:02.060 --> 32:09.840]  just try 2, 80, 40, or 0, 80, 40, 2, 80, 40, 4, 80, 40, until it opens. When you're starting out,
[32:09.840 --> 32:15.320]  it is actually a good idea to graph that last wheel as well, just in case you messed up on the
[32:15.320 --> 32:22.400]  first two and you did not find the correct number. It is useful to have that extra information.
[32:24.500 --> 32:32.780]  Now there's different group 2 locks. The one I am using here that I have shown is what is called
[32:33.260 --> 32:41.780]  a Sargent and Greenleaf and S&G 6730. There's two major variations of 6730 and 6741.
[32:41.780 --> 32:47.320]  They operate the same way, work the same, you cannot tell by looking at it which one it is.
[32:47.320 --> 32:54.140]  It's just that the 6730 has slightly tighter manufacturing tolerances, which is why I
[32:54.140 --> 33:01.120]  recommend going every two increments on your graph rather than every two and a half. But if you know
[33:01.120 --> 33:07.900]  you have a 6741, if it is labeled a 6741, then you can get away with going every two and a half
[33:07.900 --> 33:14.180]  increments because those tolerances in the manufacturing are not as tight and you will
[33:14.180 --> 33:18.180]  be able to find the correct number by going every two and a half increments.
[33:20.220 --> 33:27.620]  Now another popular brand is Lagarde, the Lagarde 3330. They have slightly oval wheels and
[33:27.620 --> 33:35.040]  the reason for that is because of the way that inside the wheels work, there's a certain
[33:35.040 --> 33:41.200]  mechanism that allows you to change the combination and that puts pressure on the wheels in certain
[33:41.200 --> 33:48.560]  ways and that just makes it slightly more oval shaped, which means the wheels can essentially
[33:48.560 --> 33:55.440]  mask the gates on other wheels. Maybe none of the the wheels are, you know, bigger than the others
[33:56.060 --> 34:01.340]  but they can be aligned that when they're all picked up and they're all moving together, the
[34:01.340 --> 34:08.060]  oval shape covers, essentially becomes the biggest part of the wheel pack in that location and that
[34:08.060 --> 34:14.700]  gate is never going to be, is never going to allow the fence to drop lower because one of the other
[34:14.700 --> 34:21.720]  wheels will be larger in that area. And so it can be rather difficult to work with a Lagarde 3330
[34:21.720 --> 34:30.020]  so I do not recommend starting out with that. There is also a divold which is a lock with a
[34:30.020 --> 34:35.760]  drive cam where instead of having one side that's more slanted, it will be a U-shape,
[34:35.760 --> 34:42.780]  more uniform U-shape. And so in the case of a divold group 2, you want to take both contact
[34:42.780 --> 34:48.000]  points into account since there will be less variation. You want to take both into account
[34:48.000 --> 34:52.780]  and look at the left going up and the right contact point going down.
[34:54.300 --> 35:03.200]  Whoops. Now some final tips is you want to be really precise in dialing. You want to
[35:03.860 --> 35:08.840]  not just read it in one-eighth of an increment, but you want to dial to one-eighth of an increment.
[35:08.840 --> 35:15.240]  You want to make sure you're not accidentally dialing 16 and one-eighth or 16 and one-fourth
[35:15.240 --> 35:20.980]  because you're going every two increments. So maybe the combination is 15. You don't want to
[35:20.980 --> 35:26.960]  go 16 and one-eighth and have it not open, but maybe on 16 you can detect it. You can detect
[35:26.960 --> 35:31.560]  that it's the correct number but not 16 and one-eighth. You want to make sure you're reading
[35:31.560 --> 35:37.400]  the dial from the same angle each time. So if you're looking at the safe lock, you want to
[35:37.400 --> 35:41.840]  make sure you are reading from the same angle. Let's say you're reading it from this angle
[35:41.840 --> 35:47.620]  this time. You don't want to look at it like this as that will change where you
[35:47.620 --> 35:54.120]  think that contact point is. So you want to make sure you're really consistent, especially also
[35:54.120 --> 35:59.180]  with the amount of force that you use. You want to make sure it's the lightest possible and you
[35:59.180 --> 36:04.360]  want to make sure it is the same each time. So you want to be really consistent in everything you do.
[36:05.520 --> 36:10.720]  You can also try it with a known combination. You can, let's say you know the combination is
[36:10.720 --> 36:19.880]  20, 40, 60. Well you can test at 20, 40, and 60. You don't have to graph the entirety of the dial.
[36:19.940 --> 36:26.740]  So just to be able to detect how the contact point feels when one of the gates is under
[36:26.740 --> 36:33.020]  the fence and how it feels when it's not, you can graph from let's say 10 to 30 and then like
[36:33.020 --> 36:38.040]  you know 10 above and 10 below each of the numbers 20, 40, and 60 so that you can tell
[36:38.040 --> 36:46.000]  how the graph is supposed to look. And that is a very very useful practice to do. You can also
[36:46.000 --> 36:50.900]  remove the back cover of the lock so that you know exactly what's happening and you can really
[36:50.900 --> 36:55.500]  correlate what you're feeling with what is happening inside the lock. And then if all else
[36:55.500 --> 37:02.400]  fails you can buy my book. Well not really, I put it online for free. So it is on Amazon but I don't
[37:02.400 --> 37:09.780]  recommend it unless you really want a hard copy. There's a PDF I have uploaded at this link down
[37:09.780 --> 37:17.020]  here and you can download it and basically just do whatever you want with it. I don't care.
[37:17.940 --> 37:25.080]  Now on YouTube I have a video series that follows a book. It's similar to this talk but it's a lot
[37:25.080 --> 37:33.020]  more in-depth. So it covers different sections that I have covered here in this talk but with
[37:33.880 --> 37:39.500]  much greater detail and I also cover additional more advanced techniques in order to figure out
[37:39.500 --> 37:45.640]  the combination faster and with greater precision. There's online forums such as this link at the
[37:45.640 --> 37:52.120]  bottom here it points to keypicking.com and they are very welcoming to newcomers as long as you
[37:52.120 --> 37:59.380]  are able to show that you are not trying to use this knowledge for criminal activities and you
[37:59.380 --> 38:05.380]  are interested in this as a hobby. I mean people are very welcoming. On ebay you can buy locks on
[38:05.380 --> 38:17.060]  ebay. I highly recommend sng6730 or 6741. You can also just search up sng6700 series.
[38:17.910 --> 38:25.160]  And just practice. I mean practice is the best way to learn. I mean you can read and watch all
[38:25.160 --> 38:30.520]  the content on safecracking and understand everything that's happening but you cannot
[38:30.520 --> 38:36.380]  develop the touch for feeling the contact point. You don't develop the sight for reading the contact
[38:36.380 --> 38:43.380]  point unless you actually practice. And I also just remember I forgot to mention this picture
[38:43.380 --> 38:48.720]  here. So in order to read the contact points and dial it more accurately you can take a piece of
[38:48.720 --> 38:56.000]  paper or maybe a needle or anything and tape it onto the dial and the dial ring just to be able
[38:56.000 --> 39:04.380]  to more precisely pinpoint what is on the dial. And that is the end of this presentation.
